Hacking duo charged with DDoSing Amazon, then bragging about it

Feds say the pair also launched crippling Web attacks on eBay and Priceline.

Federal prosecutors have charged two men with using a computer botnet to launch crippling Web attacks on Amazon, eBay, and Priceline, and then bragging about them in online hacker forums.

Dmitry Olegovich Zubakha, 25, of Moscow, was arrested in Cyprus this week for his role in attacks taking place in June and July of 2008. One of those lasted three days and prevented Amazon customers from completing online transactions, according to an indictment unsealed Thursday. In the weeks that followed, Zubakha—who went by handles Eraflame, Dima-k17, and DDService—periodically visited hacker forums to take responsibility for the DOS (or denial-of-service) attacks and to post stolen credit card numbers he had obtained, prosecutors further alleged. In the same forums, he marketed hacking services including for-rent botnets.

Sergey Viktorovich Logashov was a co-conspirator in the DOS campaign, which also hit eBay and Priceline. This is all according to the 12-page indictment filed in US District Court in Seattle. At one point, he allegedly called Priceline and advertised his expertise in stopping the attacks, which were causing the websites to become unresponsive by bombarding them with more traffic than they could handle. Using a fleet of compromised computers, they overwhelmed their targets by causing huge numbers of requests for "large and resource intensive webpages on a magnitude of 600 percent to 1000 percent of normal traffic levels," prosecutors wrote in the indictment.

Zubakha and Logashov, which Seattle US Attorney John Durkan referred to as "cyber bandits," were each charged with conspiracy to intentionally cause damage without authorization to a protected computer and intentionally causing damage to a protected computer resulting in a loss of more than $5,000. Zubakha was also charged with aggravated identity theft and possession of stolen data for more than 28,000 credit cards. They have yet to appear in court to answer the charges.

27 Reader Comments

What is it with idiots bragging about their crimes these days? When I was a kid, I kept my damn mouth shut when I got away with something I should not have been doing. Granted, it was minor stuff that never would have even landed me in jail. Still, I had the sense to just shut the hell up about it.

It doesn't seem to have anything to do with the nature of the crime either. In some cases it's a physical act like bank robbery, car theft or in extreme cases murder. Others are idiots like the ones mentioned in the article bragging about DDoS'ing sites, hacking into e-mail servers or releasing private customer data to the world.

I think most people, even those who really do know better, think that the relative anonymity of the internet actually makes them anonymous. In the back of their minds, they believe nobody could possibly connect their real world selves with their online selves, even though this idea is proven false in alarming new ways almost every day.

I think most people, even those who really do know better, think that the relative anonymity of the internet actually makes them anonymous. In the back of their minds, they believe nobody could possibly connect their real world selves with their online selves, even though this idea is proven false in alarming new ways almost every day.

Although, as another poster commented above yours, there was a time when anonimity was cherished and people relished in the attempts of people to uncover them. Those people in those days would never have trusted the internet in the way these kids do nowadays. Is this willful ignorance or a lack of education? Or just your normal, "teen hormones make them think they have super powers".

The title is a trifle misleading: I think they were charged with the crimes, but not with bragging.

yeah i was totally confused by it. /s

The allegations that one hacker bragged about the attacks online, and that the other called Priceline, are contained in the indictment to support conspiracy charges. Mentioning it in the headline is no more misleading than mentioning the DDoS attacks themselves.

The title is a trifle misleading: I think they were charged with the crimes, but not with bragging.

yeah i was totally confused by it. /s

The allegations that one hacker bragged about the attacks online, and that the other called Priceline, are contained in the indictment to support conspiracy charges. Mentioning it in the headline is no more misleading than mentioning the DDoS attacks themselves.

What is it with idiots bragging about their crimes these days? When I was a kid, I kept my damn mouth shut when I got away with something I should not have been doing. Granted, it was minor stuff that never would have even landed me in jail. Still, I had the sense to just shut the hell up about it.

It doesn't seem to have anything to do with the nature of the crime either. In some cases it's a physical act like bank robbery, car theft or in extreme cases murder. Others are idiots like the ones mentioned in the article bragging about DDoS'ing sites, hacking into e-mail servers or releasing private customer data to the world.

Yes, there are a lot of people who brag about illegal activities because they seem to be too dumb to know better, but in this case;

From Article wrote:

In the same forums, he marketed hacking services including for-rent botnets.

How are they going to get customers for their for-rent botnets if they don't advertise? And isn't bragging on a hacking site one of the few ways an average bot-net "owner" can advertise? After all, the attacks would provide potential customers some evidence that the botnet can be effective.

So perhaps the bragging was not just stupidity, even though the way things worked out, it may as well have been. Advertising illegal services brings its own problems, after all, as this example shows..

A headline like that is not acceptable, since it completely omits any mention of the federal charges, which are the most important element of this article. The headline proposed here makes it sound as if Ars Technica is leveling these less-than-flattering allegations, when in fact it's the federal government that's doing so.

It's called Darwinism in action, stupid people weed themselves out of the evolutionary chain all the time.

As someone already mentioned those who are good, and I mean really good, don't talk about it, ever. You especially don't talk about it on the phone, the web, via email, texting and if you are real paranoid not even snail mail.

So again idiots who spout off on a public board deserve to get whacked.

The title is a trifle misleading: I think they were charged with the crimes, but not with bragging.

yeah i was totally confused by it. /s

The allegations that one hacker bragged about the attacks online, and that the other called Priceline, are contained in the indictment to support conspiracy charges. Mentioning it in the headline is no more misleading than mentioning the DDoS attacks themselves.

But they were not charged with bragging about it, were they? Typical headline, ignoring grammar for "attention".

Seriously Dan, I assume your first line of defence will be "everyone knows what we mean", while the second will be "just doing what every newspaper does". Neither defence is worthy - you're a writer, you are paid to write articles in the English language, you need to make sure you apply the basic rules of that language.

To the second argument, that's like a phone manufacturer saying "everyone else is suing over patents, so we should too". Just because everyone else is behaving badly is no excuse for behaving badly (or in this case, writing poor headlines).

There are many circles in which anyone who can so much as run a malicious script is lauded as brilliant and/or innocent. Any of their victims are then derided as stupid for not having complete foreknowledge of any possible attack, and unlimited resources with which to avoid it. It's a guilt-avoidance mechanism, but not all those who participate are able to recognize it as such. When some sites present the effort as journalism and toss out various justifications, some people actually believe it.

Likewise, there are many people who deeply believe that anyone in IT security or working law enforcement for an entity they have a beef against MUST be stupid. Anyone even vaguely familiar with Anons, for example, knows how much they elevated themselves and dismissed their foes. (Take some time and talk to Sabu about how "stupid" the people who've been pimping him are.) But once you believe you're a super-genius and your foes are buffoons, what's the harm in bragging? Right?

It's called Darwinism in action, stupid people weed themselves out of the evolutionary chain all the time.

As someone already mentioned those who are good, and I mean really good, don't talk about it, ever. You especially don't talk about it on the phone, the web, via email, texting and if you are real paranoid not even snail mail.

So again idiots who spout off on a public board deserve to get whacked.

I think that Darwinism isn't working. Had it worked we have a lot less stupid people by now.

Akemi wrote:What is it with idiots bragging about their crimes these days?

LeaderlessByChoice wrote:It's called Darwinism in action, stupid people weed themselves out of the evolutionary chain all the time.

It's Darwinism only if they are prevented from reproducing. Like life in prison. Execution. Fortuitous fatal accident.

A fitting punishment might be to print all the DDoS HTTP Gets they caused to issue on 8 1/2" x 11" sheets of paper, one get per page. Put the convicts in a silo, lock the door, turn-on a webcam with a feed to a website, fill the silo with the printed Gets. Might make the message clear and understandable to the other Darwinian idiots out there thinking of doing their own DDoS attacks.

What is it with idiots bragging about their crimes these days? When I was a kid, I kept my damn mouth shut when I got away with something I should not have been doing. Granted, it was minor stuff that never would have even landed me in jail. Still, I had the sense to just shut the hell up about it.

It doesn't seem to have anything to do with the nature of the crime either. In some cases it's a physical act like bank robbery, car theft or in extreme cases murder. Others are idiots like the ones mentioned in the article bragging about DDoS'ing sites, hacking into e-mail servers or releasing private customer data to the world.

Celebrity culture my friend. There is nothing more important these days than being famous.

Zubakha and Logashov, which Seattle US Attorney John Durkan referred to as "cyber bandits," were each charged with conspiracy to intentionally cause damage without authorization to a protected computer and intentionally causing damage to a protected computer resulting in a loss of more than $5,000